It started, as so many modern disasters do, with a tip to a journalist. Independent cybersecurity reporter Brian Krebs was alerted to a listing on a Russian-language cybercrime forum in late August, pointing him toward a dark web storefront calling itself “Nexus.” What he found there has since spiraled into what experts are calling one of the largest exposures of government identity documents in North American history.

According to Krebs’s reporting, Nexus was offering searchable access to more than 153 million driver’s licenses belonging to people in the United States and Canada, along with over 10 million identification cards, more than 3 million travel documents, and roughly 579,000 medical cards. To prove the data was real, the site’s operators had allegedly included Krebs’s own driver’s license as a free sample. He said he was able to independently verify the authenticity of the documents with nine separate individuals.

The listing, Krebs reported, wasn’t a static dump — it was growing by roughly 400,000 new records every 24 hours, a detail that suggested the breach was live and ongoing rather than a one-time historical leak. That detail alarmed cybersecurity researchers more than almost anything else about the case: a static breach is a wound; a live one is a hemorrhage.

The U.S. Federal Bureau of Investigation confirmed on September 2 that it had opened an investigation, though it declined to comment further, citing the ongoing nature of the case. Circumstantial evidence — timestamps, metadata patterns, and the nature of the exposed records — pointed investigators toward IDScan.net, a Louisiana-based identity verification company whose technology underpins age and identity checks for retailers, bars, and a roster of Fortune 500 clients. The company later confirmed it had detected unauthorized access to its systems around September 1 and said it had begun working with third-party forensic specialists to determine the scope of the intrusion.

In Canada, the response has been more measured but no less watchful. The RCMP said in a statement that it is aware of reports regarding the FBI’s investigation and is “monitoring the situation,” while continuing to coordinate with domestic and international law enforcement and cybersecurity partners. The force declined to comment further, noting it does not lead the investigation, which currently sits with the FBI and its international counterparts.

What makes this breach different from the seemingly endless parade of corporate data leaks that precede it isn’t just its scale — it’s the nature of what was taken. A stolen credit card number can be cancelled within minutes. A driver’s license, on the other hand, is a document tied to a person’s physical identity in ways that are far harder to reissue or invalidate at scale. Security researchers have compared the exposure to historic breaches like Equifax and the U.S. Office of Personnel Management hack, both of which are still cited today as watershed moments in identity theft risk.

That comparison took on a sharper edge when the national security outlet Lawfare published an analysis on September 14 arguing that the Nexus breach isn’t merely a consumer privacy failure — it’s a strategic intelligence problem. According to Lawfare’s estimate, the exposed dataset covers roughly 63 percent of all licensed drivers in the United States, a staggering proportion that, if paired with other stolen datasets, could theoretically allow a sophisticated actor to unmask undercover intelligence officers, track the movements of diplomats, or build detailed profiles of government officials on both sides of the border. Adding fuel to that concern, reporting indicated the exposed data reportedly included identification belonging to at least one senior U.S. official.

James E. Lee, president of the Identity Theft Resource Center, which has tracked data breaches since 2005, said there has simply never been a breach of driver’s licenses at this scale before. He warned that the stolen dataset will likely retain value to cybercriminals for years to come, and that some version of the Nexus marketplace — or something very similar — is likely to resurface even though the original site abruptly went dark on September 2, shortly after Krebs’s reporting was published.

For everyday Canadians, the breach raises uncomfortable practical questions with no easy answers. Unlike a compromised password, a driver’s license number can’t simply be changed at will in most provinces; replacing one typically requires proof of the very kind of identity theft the breach might now make easier to commit. Provincial licensing authorities across Canada have not yet issued specific guidance tailored to the breach, and it remains unclear how many Canadian records, precisely, are implicated versus American ones — a distinction complicated by the fact that IDScan.net serviced clients across both countries.

Cybersecurity experts recommend that Canadians concerned about exposure monitor their credit reports closely, consider placing a fraud alert with credit bureaus, and be especially wary of unsolicited communications referencing personal identification details, which scammers may now be able to reference with unsettling accuracy. As investigators in Washington and Ottawa continue piecing together how the breach occurred and how far it has spread, one thing is already clear: the Nexus case has redrawn, in the starkest terms yet, just how vulnerable the digital infrastructure underpinning everyday identity verification has become.